Implementing Control Assurance Frameworks CCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A government agency is required to comply with FISMA and also needs to align with the NIST Cybersecurity Framework for internal risk management. The CISO must select a control assurance framework that satisfies both requirements without duplicating efforts. Which approach is most effective?

   • AAdopt ISO/IEC 27001 and claim it satisfies FISMA.
   • BUse NIST SP 800-53 as the primary framework and map it to the NIST CSF functions.
   • CUse the NIST CSF as the primary framework and ignore FISMA-specific controls.
   • DImplement two separate frameworks without any mapping.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A healthcare organization is implementing the HITRUST CSF and must also comply with HIPAA. The CISO has limited staff and needs to implement controls efficiently. Which implementation approach is most effective?

   • AImplement HIPAA requirements first and then add HITRUST controls later.
   • BImplement HITRUST CSF controls and leverage its built-in mapping to HIPAA requirements.
   • CImplement only the HITRUST controls that are not covered by HIPAA.
   • DUse a separate team to implement HIPAA and another to implement HITRUST.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A multinational organization with headquarters in the EU and subsidiaries in Asia and North America processes personal data of EU residents. The CISO must select a control assurance framework that will satisfy GDPR requirements, support external audits, and provide a certifiable baseline. Which framework selection is most appropriate?

   • AISO/IEC 27001, because it provides a certifiable ISMS that aligns with GDPR expectations and supports external audit.
   • BNIST Cybersecurity Framework, because it is mandatory for all organizations processing EU personal data.
   • CCIS Controls, because they are legally required for all companies operating in the EU.
   • DCOBIT 2019, because it is the only framework that addresses data privacy regulations.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A mid-sized e-commerce company is considering adopting a control assurance framework. They need a framework that is cost-effective, provides a prioritized set of controls, and is widely recognized by their customers. Which framework best fits these needs?

   • AISO/IEC 27001, because it is the least expensive framework to implement.
   • BCOBIT 2019, because it provides a simple checklist of controls without requiring governance processes.
   • CCIS Controls, because they offer a prioritized, cost-effective set of safeguards that are widely referenced.
   • DNIST Cybersecurity Framework, because it is mandatory for all e-commerce companies.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A government contractor must comply with CMMC (Cybersecurity Maturity Model Certification) requirements. The CISO needs to select a control assurance framework that will support CMMC compliance. Which framework is most directly aligned?

   • ACOBIT 2019, because it provides the exact controls required for CMMC.
   • BNIST SP 800-171, because CMMC is based on the controls in NIST SP 800-171.
   • CCIS Controls, because they are mandatory for all government contractors.
   • DISO/IEC 27001, because it is the only framework accepted by the Department of Defense.
   Reveal Solution Discussion Select an answer first